Escape special characters in Javascript SQL Query

Question

I'm trying to send an SQL query with javascript using a variable sourced from an input. In this input, characters like ' and " along with others may be entered.

Here's what my script function looks like:

function insertJobDesc (r) {
        rowid=r;
        var qty = document.getElementById('Qty' + r).value;
        var desc = document.getElementById('Desc' + r).value;
        desc = desc.replace(/&/g, "&amp;").replace(/>/g, "&gt;").replace(/</g, "&lt;").replace(/"/g, '"&quot;"').replace(/'/g, '"&#039;"');

        sendAsync("editDatabase.php?sql=UPDATE+jobdesc+SET+qty="+qty+",+description='"+desc+"',+rowID="+rowid+"+WHERE+id="+rowid+"+AND+jobID="+jobID);
    }

An example of the value for 'desc' that I'd want to send is: 80-0234-1 6'5" GATE So it's a combination of numbers, letters, and special characters. I tried to replace each of them but it didn't work out.

Any ideas?

Answer 1

Use encodeURIComponent()

function insertJobDesc (r) {
    rowid=r;
    var qty = document.getElementById('Qty' + r).value;
    var desc = encodeURIComponent(document.getElementById('Desc' + r).value);

    sendAsync("editDatabase.php?sql=UPDATE+jobdesc+SET+qty="+qty+",+description='"+desc+"',+rowID="+rowid+"+WHERE+id="+rowid+"+AND+jobID="+jobID);
}

Disclaimer: Don't ever do anything like this...